Relax performanced vr:app:render permission restriction

This CL allows apps to request the vr:app:render performanced
policy. Previously we only allowed VrCore or system processes to request
vr:app:render.

We now restrict vr:app:render to a single thread system-wide. If we
allow multiple vr:app:render threads, a misbehaving app can lock up the
entire device.

Allowing apps to directly request vr:app:render has the problem that a
misbehaving background app can "steal" vr:app:render from the foreground
app. I haven't found that to occur in practice, but it can be fixed by
having VrCore decide which app gets vr:app:render, although that will
require some extra communication between the app and VrCore.

Bug: 73722517

Test: - Made local changes to gvr apps and confirmed they can request
vr:app:render.

- Confirmed that vr:app:render transfers successfully when switching
  apps.

- Modified treasure hunt to request vr:app:render policy on multiple
  threads, and confirmed that vr:app:render transfers between the
  threads, so there's only ever one thread with vr:app:render. (This
  test also revealed that without the "only one thread gets
  vr:app:render" restriction, Vega freezes when those threads busy
  loop).

Change-Id: I2fc5ff9fae9ea5160e1637995b3d1261494d1383